diff --git a/content/blog/newsletter_10_26.md b/content/blog/newsletter_10_26.md index 6fcc21cf8..23abc9ba8 100644 --- a/content/blog/newsletter_10_26.md +++ b/content/blog/newsletter_10_26.md @@ -1,5 +1,5 @@ -title: Inside Infra October 2026 -date: '2026-10-22' +title: Inside Infra October 2026 +date: '2026-10-22' permalink: newsletter1026 layout: post ## Welcome to *Inside Infra* for October, 2026 @@ -10,15 +10,15 @@ October's Roundtable was an in-person event during Community Over Code Glasgow. Note: the next online Roundtable will be **November 4, 1700 GMT**. We will be trying out a new format. Here are some of the changes: - - The roundtable will run up to 90 minutes, rather than 60. - - There will be two half-hour presentation slots at each meeting: Infra will select the topic and make the presentation for one, and Tooling will do the same for the other. - - We will try to keep all questions for the final half hour. +- The roundtable will run up to 90 minutes, rather than 60. +- There will be two half-hour presentation slots at each meeting: Infra will select the topic and make the presentation for one, and Tooling will do the same for the other. +- We will try to keep all questions for the final half hour. For details about joining one of the online roundtables, and what goes on at one, are at: The Infra Roundtable. ### Infra at Community Over Code Glasgow -The Infra team was present in force at Community Over Code Glasgow, offering a full track of talks and discussions, and engaging in hallway conversations with all and sundry who had infrastructure-related questions or suggestions. The Infra track had 7 sessions, most of which attracted audiences of between 15-40 people. +The Infra team was present in force at Community Over Code Glasgow, offering a full track of talks and discussions, and engaging in hallway conversations with all and sundry who had infrastructure-related questions or suggestions. The Infra track had 7 sessions, most of which attracted audiences of between 15-40 people. About fifty people took active and enthusiastic part in Games Night, confirming the role that event plays in creating a space for joy at the ASF. @@ -46,18 +46,18 @@ Infra identified and resolved problems related to downstream handling of DKIM (d The ASF mailing list archive, at lists.apache.org, has had a significant makeover. -_Enhanced security_: 2FA is now required for new sign-ins, using the ASF's official OIDC provider (`mfa.apache.org`). If you have not yet enrolled for 2FA, now is a good time to do so. Initiating a login will start the enrollment process if you have not yet set up 2FA for your account. +*Enhanced security*: 2FA is now required for new sign-ins, using the ASF's official OIDC provider (`mfa.apache.org`). If you have not yet enrolled for 2FA, now is a good time to do so. Initiating a login will start the enrollment process if you have not yet set up 2FA for your account. -_Favorite lists_: Favorite any lists you like and you can see a compiled activity summary for just those lists, as if they were a single project.. +*Favorite lists*: Favorite any lists you like and you can see a compiled activity summary for just those lists, as if they were a single project.. -_UI fixes/changes_: +*UI fixes/changes*: - - `ctrl+c` now properly copies text instead of opening up the compose dialog. - - middle mouse button works as intended again, no longer causes a 404 message. - - The site now has dark and light modes, defaulting to your desktop or browser's display settings. - - You can switch between the traditional list view and a new forum style view, where +1s count as upvotes on topics, for a more familiar feel for those who may not have the same love for mailing lists as some of us. - - A new streaming API provides results for huge lists much faster, by streaming the results as you flip through the pages. No more waiting for a minute or three for a list with 25,000 monthly emails to load. - - Feeds are back! Use your favorite atom feed app to subscribe to list updates. +- `ctrl+c` now properly copies text instead of opening up the compose dialog. +- middle mouse button works as intended again, no longer causes a 404 message. +- The site now has dark and light modes, defaulting to your desktop or browser's display settings. +- You can switch between the traditional list view and a new forum style view, where +1s count as upvotes on topics, for a more familiar feel for those who may not have the same love for mailing lists as some of us. +- A new streaming API provides results for huge lists much faster, by streaming the results as you flip through the pages. No more waiting for a minute or three for a list with 25,000 monthly emails to load. +- Feeds are back! Use your favorite atom feed app to subscribe to list updates. ### More MFA at the ASF @@ -67,10 +67,10 @@ As we upgrade a service to use MFA, you'll notice that its login screen will cha Currently, MFA is enabled for: - - Apache Trusted Releases (ATR) - - Mailing list archives - - Security reports dashboard - - WebMod +- Apache Trusted Releases (ATR) +- Mailing list archives +- Security reports dashboard +- WebMod Services that will be enabling MFA in the near future include, but are not limited to: @@ -93,4 +93,3 @@ If you have questions or issues about using MFA at the ASF, contact us via email ### Infra 101 From November 2026, GitHub is disabling the `pull_request_target` trigger for ASF repositories. Projects still using it should migrate to the safer replacement described on the GitHub Actions Policy page. - diff --git a/content/pages/services.md b/content/pages/services.md index ceb769c39..3701e08e9 100644 --- a/content/pages/services.md +++ b/content/pages/services.md @@ -180,7 +180,7 @@ Here are ways you and your PMC can help mitigate this issue: For worked examples of these and further optimizations, see [Optimizing GitHub Actions workflows](github-actions-optimization.html). -- **Optimize PR workflows**: Run full test suites periodically on main merges or via scheduled "canary" builds rather than on every PR. Use `paths:` filters in GitHub Actions YAML, write custom scripts to determine dynamic build matrix outputs, or utilize tools like Apache Yetus or [Develocity](gradle.html) (develocity.apache.org) for predictive test selection. Contact Infra via a Jira ticket or by email to `users@infra` for advice on the best approach for your project. +- **Optimize PR workflows**: Run full test suites periodically on main merges or via scheduled "canary" builds rather than on every PR. Use `paths:` filters in GitHub Actions YAML, write custom scripts to determine dynamic build matrix outputs, or utilize tools like Apache Yetus or [Develocity](gradle.html) (develocity.apache.org) for predictive test selection. See [Optimizing GitHub Actions workflows](github-actions-optimization.html) for worked examples of [running only the tests a change needs](github-actions-optimization.html#selective-tests) and [scheduled canary builds](github-actions-optimization.html#canary). Contact Infra via a Jira ticket or by email to `users@infra` for advice on the best approach for your project. - **Review workflows for anomalies**: Check for deprecated labels like `macos-13`, which cause workers to hang in "waiting for runner" status and artificially inflate queue sizes. Also, review custom parallelism settings that might block valid jobs. The [GitHub Actions Policy](github-actions-policy.html) requires a job concurrency level of 20 or less per workflow, and recommends staying at or below 15. - **Group your dependency updates**: An ungrouped Dependabot configuration opens one pull request and one full CI run per dependency. Combine them with `groups`, and add `applies-to: security-updates` so that security fixes are batched as well instead of arriving as a stream of single-dependency PRs. See [grouping security updates](dependabot.html#group-security-updates) for the configuration. - **Pin first-party actions to a major version tag**: The [GitHub Actions Policy](github-actions-policy.html) requires a specific git hash only for **external** actions; actions in the `apache/*`, `github/*` and `actions/*` namespaces may be used without that restriction. Pinning those to a major version tag rather than to a hash lets a patch or minor release arrive without a pull request, which removes a large share of the Dependabot traffic a project sees. External actions still **MUST** be pinned to a specific git hash.